In domain mode the remote access to JMX is exposed over the remoting connector of that AS instance which is mapped to the 'remoting' socket binding which by default starts at 4447 plus any offset. As this is using the remoting connector of the AS instance the user you use to connect needs to be a user from the ApplicationRealm.

Actually if you are connecting using localhost you should be droppig in without a username and password as the local machanism should be picked up - what environment is this? Is it possible for you to capture a network trace between the server and the client?

-2.3- create a user account in the application or management realm that will be used to log in to JMX

-2.4- because we created a dedicated port binding for JMX, ensure that the jmx subsystem has: <remoting-connector use-management-endpoint="false"/>

-3- ensure jboss-cli-client.jar is on the classpath and/or requested as a dependency in your jar/ear; tip: the jar can be found under <eap7Root>/bin/client subdirectory directory of your EAP installation; without this jar, the JMX protocol "remote" will not be available